Security at Laya
Laya holds real work: native boards, docs, and synced mirrors of the Jira, Azure DevOps, monday.com, GitHub and GitLab boards you connect. This page explains, in plain words, what we store, how it is protected, and how you take access away again, from either side.
Two kinds of data, one honest rule each.
Laya is deliberate about which tool is the system of record, and about the fact that connecting a board creates a real, durable copy, not a vague “cache”.
Native boards, docs and items
Work you create directly in Laya lives with us as your system of record. It is encrypted at rest, kept for as long as your account exists (nothing is auto-purged on a schedule), and it is yours to export at any time.
Connected (mirrored) boards
When you connect a board from Jira, Azure DevOps, monday.com, GitHub or GitLab, Laya imports and keeps a durable, synced copy of each item’s fields, such as title, description, status, assignees, dates and links. Comments are read live from the source tool through its own API. On Jira boards kept in sync by the installed Laya Board for Jira app, Laya also keeps the recent comments the app sends with each issue. Your provider stays the system of record, and when you remove a board Laya deletes its mirror of it.
Laya is operated from the United Kingdom by LayaNet LTD and hosted on Amazon Web Services in the United States, with data processed under Standard Contractual Clauses and the UK IDTA. The full sub-processor list is published in the Laya privacy policy; the practical detail lives in How Laya protects your data.
Credentials are encrypted, then never shown again.
At rest
Every credential for a connected tool (OAuth tokens, API tokens and keys) is encrypted at rest with AES-256-GCM, as are webhook signing secrets. Once saved, an OAuth token, API token or personal access token is never returned by the API and never displayed in the interface again. A connection’s webhook address, which carries its webhook secret, is shown only to the workspace’s Owners and Admins, so they can add it to a tool by hand.
In transit
All traffic is encrypted in transit, and the site ships strict browser protections: a Content-Security-Policy, HSTS, clickjacking protection (frame-ancestors denied) and a locked-down Permissions-Policy.
Passwords
Your Laya password is hashed, never stored in plain text, and must be at least 5 characters, enforced on the server, not just in the form.
OAuth and API tokens, in plain words.
Laya only ever acts with credentials you explicitly grant or create. It has no more access than the account or token you gave it, and it uses that access for one job: mirroring the boards you choose and pushing back the edits you make in Laya. Boards you have not connected are never touched.
| Tool | How it connects | How you revoke it |
|---|---|---|
| Jira | OAuth (sign in with Atlassian), an API token, or the installed Laya Board for Jira app | Disconnect in Laya, remove Laya from your Atlassian account’s authorised apps, or uninstall the app from the site |
| Azure DevOps | Microsoft Entra OAuth, or a personal access token (PAT) | Disconnect in Laya, revoke the PAT in Azure DevOps, or remove Laya’s authorisation from your Microsoft account |
| monday.com | An API token | Disconnect in Laya, or regenerate / revoke the token in your monday.com account settings |
| GitHub | A personal access token, or GitHub OAuth where it is configured | Disconnect in Laya, delete the token in GitHub developer settings, or revoke Laya’s OAuth authorisation |
| GitLab | A personal access token, or GitLab OAuth where it is configured | Disconnect in Laya, revoke the token in GitLab, or revoke Laya’s OAuth authorisation from your applications |
The workspace Owner decides which roles can connect a tool (Members can by default). Disconnecting is restricted to the workspace Owner and Admin roles, and wipes the stored credentials; removing a board deletes its mirror. The full breakdown (including what each grant is used for) is in Provider permissions and scopes and Disconnecting safely: what stays and what goes.
Sign-in security you control.
Ways in
Email and password, single-use magic links that expire after 10 minutes, or sign-in with Atlassian, Azure DevOps, Google, Microsoft or Slack. Sign-in and account routes are rate-limited against brute force. Every method is covered in Sign-in methods.
Two-factor authentication
Opt-in 2FA with passkeys (Face ID, Touch ID, Windows Hello or a security key) as the primary factor, an authenticator app as the fallback, and single-use recovery codes. Once it is on, the second factor is asked for on every route into Laya.net, including magic links and social sign-in. Sign in with Laya on planningpoker.org does not ask again: it uses your Laya.net sign-in in that browser. Set it up with the two-factor authentication guide.
Sessions you can end instantly
Laya keeps you signed in rather than logging you out on a timer, which is safe because every request is checked server-side, so signing a session out from the Active sessions list kills it immediately, whatever the token’s age. The exception is planningpoker.org: a Sign in with Laya sign-in there ends after 30 days at most, or sooner when the Laya.net sign-in behind it ends, and it is on the same list. Details in Sessions and account security.
Share links stay private by default.
Public links for boards, docs and roadmaps are secret-token URLs: the token in the link is the only credential, so the link itself is the key.
- Public views are read-only and rate-limited per IP.
- Board shares let the owner choose which columns and card fields are visible, and whether viewers can open a read-only detail view.
- Links can be revoked at any time. A revoked link shows an error, not content.
- Share URLs are excluded from search engines: they are disallowed for crawlers and never listed in Laya’s sitemap.
See Sharing boards publicly for the controls in detail.
What Laya never does.
We do not sell your data, and we do not use your content to train AI models. Where AI features are available, the provider receives only the content you choose to run them on. Analytics run on the marketing site only, only after you accept them, and a Global Privacy Control or Do Not Track signal from your browser counts as a refusal unless you turn them on yourself. We act on your instruction and never repurpose your content.
Found a vulnerability, or seen activity on your account you do not recognise? Email support@laya.net with “Security report” in the subject line and steps to reproduce, and please never include passwords, tokens or recovery codes in the email.
Privacy requests, including data erasure, go to privacy@laya.net and are answered within one month. The formal terms live in the privacy policy and terms of service.
The enterprise review pack, published.
Everything a security or legal review normally requests, as living documents your team can read, link to and save as PDF: no NDA dance, no waiting on an attachment.
Try Laya with your own guardrails on.
Connect a board with a scoped grant, mirror it, and remove it whenever you like. The mirror goes with it. Free plan, no card needed: see plans and pricing